/* sFlow Datagram Version 4 */ /* Revision History - version 4 adds support BGP communities - version 3 adds support for extended_url information */ /* sFlow Sample types */ /* Address Types */ typedef opaque ip_v4[4]; typedef opaque ip_v6[16]; enum address_type { IP_V4 = 1, IP_V6 = 2 } union address (address_type type) { case IP_V4: ip_v4; case IP_V6: ip_v6; } /* Packet header data */ const MAX_HEADER_SIZE = 256; /* The maximum sampled header size. */ /* The header protocol describes the format of the sampled header */ enum header_protocol { ETHERNET-ISO8023 = 1, ISO88024-TOKENBUS = 2, ISO88025-TOKENRING = 3, FDDI = 4, FRAME-RELAY = 5, X25 = 6, PPP = 7, SMDS = 8, AAL5 = 9, AAL5-IP = 10, /* e.g., Cisco AAL5 mux */ IPv4 = 11, IPv6 = 12, MPLS = 13 } struct sampled_header { header_protocol protocol; /* Format of sampled header */ unsigned int frame_length; /* Original length of packet before sampling */ opaque header; /* Header bytes */ } /* Packet IP version 4 data */ struct sampled_ipv4 { unsigned int length; /* The length of the IP packet excluding lower layer encapsulations */ unsigned int protocol; /* IP Protocol type (for example, TCP = 6, UDP = 17) */ ip_v4 src_ip; /* Source IP Address */ ip_v4 dst_ip; /* Destination IP Address */ unsigned int src_port; /* TCP/UDP source port number or equivalent */ unsigned int dst_port; /* TCP/UDP destination port number or equivalent */ unsigned int tcp_flags; /* TCP flags */ unsigned int tos; /* IP type of service */ } /* Packet IP version 6 data */ struct sampled_ipv6 { unsigned int length; /* The length of the IP packet excluding lower layer encapsulations */ unsigned int protocol; /* IP next header (for example, TCP = 6, UDP = 17) */ ip_v6 src_ip; /* Source IP Address */ ip_v6 dst_ip; /* Destination IP Address */ unsigned int src_port; /* TCP/UDP source port number or equivalent */ unsigned int dst_port; /* TCP/UDP destination port number or equivalent */ unsigned int tcp_flags; /* TCP flags */ unsigned int priority; /* IP priority */ } /* Packet data */ enum packet_information_type { HEADER = 1, /* Packet headers are sampled */ IPV4 = 2, /* IP version 4 data */ IPV6 = 3 /* IP version 6 data */ } union packet_data_type (packet_information_type type) { case HEADER: sampled_header header; case IPV4: sampled_ipv4 ipv4; case IPV6: sampled_ipv6 ipv6; } /* Extended data types */ /* Extended switch data */ struct extended_switch { unsigned int src_vlan; /* The 802.1Q VLAN id of incoming frame */ unsigned int src_priority; /* The 802.1p priority of incoming frame */ unsigned int dst_vlan; /* The 802.1Q VLAN id of outgoing frame */ unsigned int dst_priority; /* The 802.1p priority of outgoing frame */ } /* Extended router data */ struct extended_router { address nexthop; /* IP address of next hop router */ unsigned int src_mask; /* Source address prefix mask bits */ unsigned int dst_mask; /* Destination address prefix mask bits */ } /* Extended gateway data */ enum as_path_segment_type { AS_SET = 1, /* Unordered set of ASs */ AS_SEQUENCE = 2 /* Ordered set of ASs */ } union as_path_type (as_path_segment_type) { case AS_SET: unsigned int as_set<>; case AS_SEQUENCE: unsigned int as_sequence<>; } struct extended_gateway { unsigned int as; /* Autonomous system number of router */ unsigned int src_as; /* Autonomous system number of source */ unsigned int src_peer_as; /* Autonomous system number of source peer */ as_path_type dst_as_path<>; /* Autonomous system path to the destination */ unsigned int communities<>; /* Communities associated with this route */ unsigned int localpref; /* LocalPref associated with this route */ } /* Extended user data */ struct extended_user { string src_user<>; /* User ID associated with packet source */ string dst_user<>; /* User ID associated with packet destination */ } /* Extended URL data */ enum url_direction { src = 1, /* URL is associated with source address */ dst = 2 /* URL is associated with destination address */ } struct extended_url { url_direction direction; /* URL associated with packet source */ string url<>; /* URL associated with the packet flow */ } /* Extended data */ enum extended_information_type { SWITCH = 1, /* Extended switch information */ ROUTER = 2, /* Extended router information */ GATEWAY = 3, /* Extended gateway router information */ USER = 4, /* Extended TACACS/RADIUS user information */ URL = 5 /* Extended URL information */ } union extended_data_type (extended_information_type type) { case SWITCH: extended_switch switch; case ROUTER: extended_router router; case GATEWAY: extended_gateway gateway; case USER: extended_user user; case URL: extended_url url; } /* Format of a single flow sample */ struct flow_sample { unsigned int sequence_number; /* Incremented with each flow sample generated by this source_id */ unsigned int source_id; /* sFlowDataSource encoded as follows: The most significant byte of the source_id is used to indicate the type of sFlowDataSource (0 = ifIndex, 1 = smonVlanDataSource, 2 = entPhysicalEntry) and the lower three bytes contain the relevant index value.*/ unsigned int sampling_rate; /* sFlowPacketSamplingRate */ unsigned int sample_pool; /* Total number of packets that could have been sampled (i.e., packets skipped by sampling process + total number of samples) */ unsigned int drops; /* Number times a packet was dropped due to lack of resources */ unsigned int input; /* SNMP ifIndex of input interface. 0 if interface is not known. */ unsigned int output; /* SNMP ifIndex of output interface, 0 if interface is not known. Set most significant bit to indicate multiple destination interfaces (i.e., in case of broadcast or multicast) and set lower order bits to indicate number of destination interfaces. Examples: 0x00000002 indicates ifIndex = 2 0x00000000 ifIndex unknown. 0x80000007 indicates a packet sent to 7 interfaces. 0x80000000 indicates a packet sent to an unknown number of interfaces greater than 1. */ packet_data_type packet_data; /* Information about sampled packet */ extended_data_type extended_data<>; /* Extended flow information */ } /* Counter types */ /* Generic interface counters - see RFC 2233 */ struct if_counters { unsigned int ifIndex; unsigned int ifType; unsigned hyper ifSpeed; unsigned int ifDirection; /* derived from MAU MIB (RFC 2668) 0 = unknown, 1=full-duplex, 2=half-duplex, 3 = in, 4=out */ unsigned int ifStatus; /* bit field with the following bits assigned bit 0 = ifAdminStatus (0 = down, 1 = up) bit 1 = ifOperStatus (0 = down, 1 = up) */ unsigned hyper ifInOctets; unsigned int ifInUcastPkts; unsigned int ifInMulticastPkts; unsigned int ifInBroadcastPkts; unsigned int ifInDiscards; unsigned int ifInErrors; unsigned int ifInUnknownProtos; unsigned hyper ifOutOctets; unsigned int ifOutUcastPkts; unsigned int ifOutMulticastPkts; unsigned int ifOutBroadcastPkts; unsigned int ifOutDiscards; unsigned int ifOutErrors; unsigned int ifPromiscuousMode; } /* Ethernet interface counters - see RFC 2358 */ struct ethernet_counters { if_counters generic; unsigned int dot3StatsAlignmentErrors; unsigned int dot3StatsFCSErrors; unsigned int dot3StatsSingleCollisionFrames; unsigned int dot3StatsMultipleCollisionFrames; unsigned int dot3StatsSQETestErrors; unsigned int dot3StatsDeferredTransmissions; unsigned int dot3StatsLateCollisions; unsigned int dot3StatsExcessiveCollisions; unsigned int dot3StatsInternalMacTransmitErrors; unsigned int dot3StatsCarrierSenseErrors; unsigned int dot3StatsFrameTooLongs; unsigned int dot3StatsInternalMacReceiveErrors; unsigned int dot3StatsSymbolErrors; } /* FDDI interface counters - see RFC 1512 */ struct fddi_counters { if_counters generic; } /* Token ring counters - see RFC 1748 */ struct tokenring_counters { if_counters generic; unsigned int dot5StatsLineErrors; unsigned int dot5StatsBurstErrors; unsigned int dot5StatsACErrors; unsigned int dot5StatsAbortTransErrors; unsigned int dot5StatsInternalErrors; unsigned int dot5StatsLostFrameErrors; unsigned int dot5StatsReceiveCongestions; unsigned int dot5StatsFrameCopiedErrors; unsigned int dot5StatsTokenErrors; unsigned int dot5StatsSoftErrors; unsigned int dot5StatsHardErrors; unsigned int dot5StatsSignalLoss; unsigned int dot5StatsTransmitBeacons; unsigned int dot5StatsRecoverys; unsigned int dot5StatsLobeWires; unsigned int dot5StatsRemoves; unsigned int dot5StatsSingles; unsigned int dot5StatsFreqErrors; } /* 100 BaseVG interface counters - see RFC 2020 */ struct vg_counters { if_counters generic; unsigned int dot12InHighPriorityFrames; unsigned hyper dot12InHighPriorityOctets; unsigned int dot12InNormPriorityFrames; unsigned hyper dot12InNormPriorityOctets; unsigned int dot12InIPMErrors; unsigned int dot12InOversizeFrameErrors; unsigned int dot12InDataErrors; unsigned int dot12InNullAddressedFrames; unsigned int dot12OutHighPriorityFrames; unsigned hyper dot12OutHighPriorityOctets; unsigned int dot12TransitionIntoTrainings; unsigned hyper dot12HCInHighPriorityOctets; unsigned hyper dot12HCInNormPriorityOctets; unsigned hyper dot12HCOutHighPriorityOctets; } /* WAN counters */ struct wan_counters { if_counters generic; } /* VLAN counters */ struct vlan_counters { unsigned int vlan_id; unsigned hyper octets; unsigned int ucastPkts; unsigned int multicastPkts; unsigned int broadcastPkts; unsigned int discards; } /* Counter data */ enum counters_version { GENERIC = 1, ETHERNET = 2, TOKENRING = 3, FDDI = 4, VG = 5, WAN = 6, VLAN = 7 } union counters_type (counters_version version) { case GENERIC: if_counters generic; case ETHERNET: ethernet_counters ethernet; case TOKENRING: tokenring_counters tokenring; case FDDI: fddi_counters fddi; case VG: vg_counters vg; case WAN: wan_counters wan; case VLAN: vlan_counters vlan; } /* Format of a single counter sample */ struct counters_sample { unsigned int sequence_number; /* Incremented with each counter sample generated by this source_id */ unsigned int source_id; /* sFlowDataSource encoded as follows: The most significant byte of the source_id is used to indicate the type of sFlowDataSource (0 = ifIndex, 1 = smonVlanDataSource, 2 = entPhysicalEntry) and the lower three bytes contain the relevant index value.*/ unsigned int sampling_interval; /* sFlowCounterSamplingInterval*/ counters_type counters; } /* Format of a sample datagram */ enum sample_types { FLOWSAMPLE = 1, COUNTERSSAMPLE = 2 } union sample_type (sample_types sampletype) { case FLOWSAMPLE: flow_sample flowsample; case COUNTERSSAMPLE: counters_sample counterssample; } struct sample_datagram_v4 { address agent_address /* IP address of sampling agent, sFlowAgentAddress. */ unsigned int sequence_number; /* Incremented with each sample datagram generated */ unsigned int uptime; /* Current time (in milliseconds since device last booted). Should be set as close to datagram transmission time as possible.*/ sample_type samples<>; /* An array of flow, counter and delay samples */ } enum datagram_version { VERSION4 = 4 } union sample_datagram_type (datagram_version version) { case VERSION4: sample_datagram_v4 datagram; } struct sample_datagram { sample_datagram_type version; }